Implement and Manage Network Security Groups AZ-700 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   You need to allow remote administration of a Windows VM using RDP (port 3389) from the internet. What is the most secure way to configure this?

   • ADisable the NSG on the subnet
   • BUse Azure Bastion instead of exposing RDP directly
   • CCreate an NSG rule allowing RDP from a specific IP range
   • DCreate an NSG rule allowing RDP from any source
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of Azure Virtual Network Manager (AVNM) security admin rules?

   • ATo enforce security rules across multiple virtual networks from a central location
   • BTo provide a VPN gateway for virtual networks
   • CTo replace the need for network security groups
   • DTo monitor network traffic for anomalies
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the default action for NSG security rules if no rule matches?

   • AAllow
   • BDeny
   • CLog
   • DRedirect
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   You need to configure an NSG to allow SSH (port 22) to a Linux VM from a specific IP address. What should you specify as the source in the inbound rule?

   • AInternet
   • BAny
   • CVirtualNetwork
   • DThe specific IP address or CIDR range
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   Your company runs a three-tier web application in Azure. The web tier VMs are in subnet A, the application tier VMs are in subnet B, and the database tier VMs are in subnet C. You need to ensure that the application tier VMs can only be reached from the web tier VMs, and that the database tier VMs can only be reached from the application tier VMs. You want to minimize the number of NSG rules and avoid hard-coding IP addresses. What should you do?

   • ACreate a custom Azure policy that automatically adds rules to each VM's network interface based on its name.
   • BAssociate a single NSG to all three subnets and use service tags for the web and application tiers.
   • CCreate three NSGs, one per subnet, and add rules that use the subnet CIDR ranges as sources and destinations.
   • DCreate an ASG for each tier, associate each ASG to the NICs of the VMs in that tier, and create NSG rules that reference the ASGs as sources and destinations.
   Reveal Solution Discussion Select an answer first